Privacy

On this page, you can find our privacy policy. For a child-friendly version, please access this page on our website, which we have written for children and young people.

Our commitments

1. We only use your data to provide you with our services and to improve your experience with us

• We will never sell your personal data
• We will never share your personal data, unless you give us permission or the law allows us to do so
• We may use anonymised data for research or insights for the benefit of the education sector

2. We always respect your data choices

• We will always be transparent about how we use your data, and give you control over how it is used
• We will always communicate in plain English so that your choices are clear.

3. We always keep your data safe

• We have systems in place to ensure your personal data is stored securely
• We keep any personal data separate from any anonymised data

4. We minimise data collected

• We only collect the personal data we need to provide our service or make it better for you
• We only keep your personal data for as long as it is needed or as long as we are required by law
• We’re always mindful that many of our users are children and we add specific protections for any data received

1. Introduction

Oak National Academy Limited is committed to protecting and preserving the privacy of visitors to our website and other people with whom we communicate electronically (for example, by email). When we refer to "you" or "your" in this policy, we are referring to you as an individual visiting our website or communicating with us electronically. We refer to Oak National Academy Limited as “Oak”, "we", "our" or "us".

Under data protection law, individuals have a right to be informed about how we use any personal information (sometimes referred to as personal data), which we hold about them. We comply with this right by providing this privacy policy. This policy applies to our website (referred to as our website) at www.thenational.academy, which also includes the following:

https://classroom.thenational.academy/
https://labs.thenational.academy/

We have separate privacy notices for our employees, volunteers, contractors and suppliers and for our recruitment process.

It is important that you read this privacy policy, together with any other information we may provide on specific occasions (for example, if you are participating in a research project with us or entering a prize draw) when we are collecting or processing personal information about you, so that you are aware of how and why we are using any information provided to us.

We are the data controller for the purposes of data protection law.

Our Data Protection Officer (DPO) is Jayne Taylor.

This Privacy Notice should be read in conjunction with our Data Protection Policy, which is available by request from our DPO.

Our contact details

• DPO Name: Jayne Taylor
• Name: Oak National Academy Limited
• Address: PO Box 520, Newcastle upon Tyne, NE3 9GW
• E-mail: [email protected]

2. Data protection principles

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• Relevant to the purposes we have told you about and limited only to those purposes;
• Accurate and kept up to date;
• Kept only as long as necessary for the purposes we have told you about;
• Kept securely.

3. Information we hold about you, what we do with it and our basis for doing so

The information below explains the various ways in which we collect, store and use (referred to as process) your personal information, the ways why we use it and our legal basis for this.

We only process your personal information where the law allows us to.

Where we invite you to provide information about yourself, it is entirely up to you whether you provide us with that information or not. Often, however, we will not be able to do something that you are asking for, if you do not provide that information (for example, if you do not provide your email address, we would be unable to complete your request to receive our e-newsletter).

If we are relying on your consent as our legal basis for processing your personal information, you may withdraw your consent at any time. We will make this clear when we ask for consent and explain how it can be withdrawn.

The personal information we process about you is not normally classed as special category data. This includes any information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic or biometric data. If we do hold any such data about you, we will inform you.

When we indicate that our legal basis for processing your personal information is our legitimate interest, this includes (but is not limited to):

• Delivering our programme of lessons and resources, including administering, managing and improving this programme, deriving insights from our programme for the education sector and resolving any related legal issues which may arise;
• Communicating with you, responding to your enquiries and managing our relationship with you, as part of our delivery and improvement of our programme.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

The following paragraphs provide information relating to how we collect information, what we collect, how we use it and our legal basis for processing that information:

Information collected automatically by our website when you visit using your electronic device (computer desktop, laptop, phone, tablet or TV)

We do not seek to identify you from this information or do anything which will affect you. To the extent practicable, we aggregate and/or remove anything which could be used to identify you from this information before we use it, including (where possible) minimising the storage of Internal Protocol (IP) addresses.

The information we collect includes:

• The IP address from which you access our website;
• Information about the device used to access the website (including the number of pupils using it);
• Your approximate location;
• Your school;
• The pages you click on our website, including the lessons that you view (and therefore your likely year group);
• The time you spend on our website, including the time you spend viewing videos;
• The resources you download.

In addition, our website uses cookies and webs beacons - please see our Cookie Policy for full details.

We use this information to improve our website, including all of the lessons and resources available to you.

Our legal basis for processing this information is our legitimate interest.

Information you input via our website

Some pages on our website invite you to provide information about yourself - for example, if you sign up to receive an e-newsletter or provide feedback through a survey.

The information collected will be clear on the relevant page, and is usually:

• Your name
• Your email address

If you are a teacher, we may ask you to also provide:

• Your school name and URN;
• Your school contact email address

How we use this information will be explained on the web pages where we ask you to submit your personal information (for example, to send you an e-newsletter), which allows us to:

• provide you with our services, such as email updates
• understand how our services are being used and help us improve the resources we create
• ensure that our educational content is reaching the intended audience
• allow us to know where our materials are being used
• allow you to opt into updates relating to the site
• allow us to invite you to share your views on how to improve Oak and the services it provides.

Our legal basis for processing this information is your consent.

Information you send us by email or other electronic means

It could be by email or through one of our social media channel (facebook, X(formerly Twitter), LinkedIn, Instagram, Threads)

Information we collect includes:

• Your name
• Contact details
• Information you include in your communication with us

We collect this information in order to:

• communicate with you;
• respond to any queries you may raise;
• manage our relationship with you.

Our legal basis for processing this information is your consent.

Information collected via our Pupil area

If you complete a quiz at the start and/or end of a lesson, any answers, marks and total scores are collected and typically anonymised.

We collect this information in order to:

• drive motivation in our users
• inform our continuous improvement of the content of our lessons

Our legal basis for processing this information is our legitimate interest.

Information collected via our feedback tool

We use a third-party tool (hosted by Gleap and Hubspot), which allows users to, for example, make enquiries, provide feedback and report technical bugs or errors in lessons to us.

Information we collect includes:

• Your name (if you provide it);
• Email address
• Approximate geo-location
• Operating system
• Browser information (type and version)
• Screen size
• URL visited
• Screenshot data
• Session replay data (for bug issues and lesson concern types only)

We collect this information in order to:

• allow us to contact you to respond to your enquiries, feedback and reports of bugs or errors - we may need clarification and further details from you or to inform you when an issue is resolved;
• analyse the content of feedback received, which in turn enables us to improve all of the lessons and resources available to our users.

Our legal basis for processing this information is your consent.

Information collected via our recruitment portal Applied

Our Recruitment Privacy Notice provides details of the personal information collected during our recruitment processes, how we use this information and our legal basis for processing it.

Information collected via our Help Centre

This is hosted by a third-party provider (Hubspot) which allows us to offer you access to support documentation and FAQ articles and to report issues or give feedback via a form

Information we collect includes:

• Name (if you provide it)
• Email address
• Information you include in your communication with us

We collect this information in order to:

• understand the usage of our support articles, which allows us to improve our users’ experience
• learn what support topics users are searching for, to help identify gaps in our knowledge base and opportunities to create missing content
• allow us to contact you to respond to your enquiries and feedback - we may need clarification and further details from you or to inform you when an issue is resolved;
• analyse the content of feedback received, which in turn enables us to improve all of the lessons and resources available to our users

Our legal basis for processing this information is your consent.

Information collected via our AI labs site

Access to this site is limited to users who create an account

When you create an account, we collect your:

• name;
• email address;
• IP address

Please refer to our Terms and Conditions in respect of prompts (“inputs”) which allow you to create lessons, including slide decks and quizzes. You must not include any information which identifies an individual in your inputs.

When you use our tools, we collect:

• Your interactions with the user interface
• Your inputs
• Outputs generated from your inputs

In addition, our website uses cookies and webs beacons - please see our Cookie Policy for full details.

We collect this information in order to:

• provide you with an account to access these tools
• contact you with regard to your account
• develop and improve our website and services, including the quality of content generated by our AI tools. Your “inputs” and “outputs” are stored for this purpose. Please see our Terms and Conditions for further details.

Our legal basis for processing this information is your consent.

We are committed to doing all we can to keep your personal information safe and secure. We have set up systems and processes to prevent unauthorised access or disclosure of your information. We also make sure that any third parties that process your information on our behalf keep your personal information secure.

We use encrypted drives to store your personal information; we limit access to only those who need access; we keep a record of data access and modification for records on our systems; we manage and restrict all devices which have access to Oak systems or services.

We will delete your personal information when we no longer need it in order to manage and deliver, or as a record of, our programme or (where relevant) our relationship with you. In particular, unless we need to keep information for longer because (for example) a dispute arises:

• information about your visits to our website will be retained for up to 5 years after the start of each session;
• e-newsletter subscription information will be retained for 5 years after you unsubscribe or we cease sending that communication, whichever is earlier;
• emails and other electronic communications will be retained for 5 years after they are sent or received, and then deleted;
• data collected via the Feedback Tool will be retained for a period of 12 months and then deleted.

Further details about how long we retain records can be found in our Retention of Records Policy, which is available upon request from our DPO.

5. Sharing your personal information

We will not sell, rent, use or share your personal information to any third party, including for marketing purposes (other than to send you our e-newsletter, with your consent), unless the law, our policies or the terms of this privacy policy allow us to do so.

Your personal information may be shared with third-party service providers who host and process your information on our behalf in order to support our programme. These third parties include, but are not limited to:

• Gleap (feedback)
• Clerk (authentication)
• Hubspot (analytics and email communications)
• Incycle (customer data management)
• PostHog (analytics)
• Bugsnag (platform monitoring)
• Zapier (integrations between other software and services)
• Sentry (error logging and platform monitoring)
• Condens (research analysis tool - if you take part in a research project with us)
• Helicone (platform monitoring)

We share aggregated information about the use of our website with some third-party providers but this does not involve disclosure of information from which you could be identified.

We may also need to share your personal information in order to protect our legal rights and comply with our legal obligations. For example, if a pupil contacts our Help Centre and raises a safeguarding concern, we may need to share this with their school. Please see our Safeguarding Statement for further details.

In respect of our website at https://labs.thenational.academy/ we currently use OpenAI’s GPT LLMs. We do not submit your personal information to OpenAI and we have opted out from automatically training OpenAI’s model.

In some cases (for example, when we host webinars), we may ask you to provide some personal information via a third party. We will always ensure that these third parties have appropriate safeguards in place to ensure your personal information is kept safe and secure.

6. International transfers

We use a range of services to ensure we can deliver fast and reliable video streaming to all our users. The majority of our technology is based within the European Economic Area and is fully compliant with the EU GDPR laws. However, some of the services we use are based outside the UK and the European Economic Area. We only use these services where we are satisfied with their levels of security and we will put contractual safeguards in place. Keep in mind that when you give us personal information it could be being transferred, stored or processed in a location outside the UK and the EEA.

7. Your rights relating to your personal information

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.

Under certain circumstances, by law, you have a number of rights in respect of your personal information:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
• Object to processing of your personal information where we are relying on our legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;
• Request the transfer of your personal information to another party.

If you wish to exercise any of these rights, please contact our DPO.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. A request will be deemed to be unfounded or excessive if it is repetitive, or asks for further copies of the same information. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

8. Complaints

Where you have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the DPO. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance by contacting our DPO.

Alternatively, you can make a complaint to the Information Commissioner’s Office:

• Report a concern online at https://ico.org.uk/concerns/
• Call 0303 123 1113
• Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

9. Changes to this privacy policy

This privacy policy is reviewed regularly, at least annually.

We reserve the right to update it at any time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable. We may also notify you in other ways from time to time about the processing of your personal information.